How HSTPA changed security deposit limits, interest, return timelines, and the documentation NYC landlords must keep.
The Housing Stability and Tenant Protection Act of 2019 rewrote the rules around security deposits in New York. Many small landlords still operate on the pre-HSTPA framework — two months' rent, hold it loosely, return what is left whenever the apartment turns over. That approach now creates real liability. The cap is lower, the timeline is shorter, and the documentation burden has shifted heavily onto the landlord.
The one-month cap
Under HSTPA, a residential security deposit cannot exceed one month's rent. That applies to nearly all residential rentals in New York, including market-rate, unregulated units. There is no exception for first-time renters, tenants without credit history, or pet owners. A pet deposit, an additional security deposit, or any other prepayment that functions as security is subject to the cap.
This is the rule landlords break most often. A tenant offers a larger deposit to compensate for a weak rental history, and the landlord accepts it. That arrangement is not enforceable. The tenant can demand the excess back at any point, and the landlord owes it.
The 14-day return rule
After the tenant vacates, the landlord must return the security deposit, less any itemized deductions, within 14 days. Not 30. Not "when the next tenant moves in." Fourteen days from the end of the tenancy.
If the landlord intends to deduct from the deposit, the law requires an itemized statement of the deductions, supported by receipts or a reasonable basis for each charge. Vague deductions ("cleaning," "wear") without specifics or documentation are challengeable.
If the landlord misses the 14-day window, the law presumes the full deposit is owed. That is a significant shift. Before HSTPA, the burden was largely on the tenant to chase the deposit. Now, the burden is on the landlord to return it on time or forfeit the right to withhold any portion.
The inspection requirement
HSTPA also added a tenant right to a pre-move-out walkthrough inspection. The tenant can request an inspection within a reasonable window before the lease ends. The landlord must conduct it, provide written notice of conditions that could lead to deductions, and give the tenant an opportunity to cure them before move-out.
This is the rule landlords most often skip without realizing it exists. If the tenant requests an inspection and the landlord ignores it, the right to deduct for those conditions can be limited later.
Deposit handling and interest
Security deposits must be held separately from the landlord's operating funds. For buildings with six or more units, deposits must be held in interest-bearing accounts, and the interest (less an administrative fee) belongs to the tenant. For smaller buildings, the interest rule is less strict, but the segregation principle still applies — commingling a deposit with personal or business funds creates liability.
The bank, branch, and account information must be disclosed to the tenant in writing. That disclosure becomes part of the lease file. Many small landlords never make this disclosure, then cannot produce it when asked.
What this means for the lease
A pre-HSTPA lease may state a two-month deposit, vague deduction language, and a 30-day return window. All three provisions are now unenforceable, and including them in a current lease is worse than silent — it suggests the landlord does not know the law, which weakens credibility in any dispute.
A compliant lease for a NYC residential unit should state the deposit at one month's rent, reference the 14-day return window, describe how deductions will be itemized, and disclose the account where the deposit is held. The pre-move-out inspection right should be referenced so that the tenant cannot later claim they were unaware of it.
The documentation problem
Most security deposit disputes are not about whether damage occurred. They are about whether the landlord can prove it. The condition of the unit at move-in, the condition at move-out, and the cost of remediation all need contemporaneous documentation.
A move-in inspection report, signed by the tenant, with date-stamped photographs, is the baseline. Without it, the landlord is arguing about damage with no comparison point. A move-out inspection on the same standard is the matching record. The 14-day itemized statement then becomes a summary backed by evidence, not a list of assertions.
Receipts for repair work, third-party invoices for cleaning, and any quotes obtained before the deduction was finalized all belong in the file. If the deduction is for a replacement (carpet, appliance, fixture), the prorated value matters — a tenant cannot be charged the full replacement cost of a ten-year-old carpet that needed to be replaced anyway.
What goes wrong
The most common failure pattern looks like this. The tenant moves out. The landlord inspects the unit, identifies several issues, and starts arranging repairs. The 14-day window passes. The repairs take longer than expected. The landlord eventually sends a deduction statement with rough numbers and no receipts. The tenant disputes the deductions. The landlord cannot produce the move-in condition record. The full deposit gets returned, and the landlord absorbs the repair costs.
That sequence is avoidable, but it requires treating the deposit as a regulated obligation from day one — not a flexible account the landlord controls.
How to handle this correctly
Set the deposit at one month's rent. Disclose the account where it is held in writing, in the lease. At move-in, conduct a documented condition inspection with the tenant present, signed and timestamped. Preserve the inspection in the lease file.
When notice of move-out is given, offer the pre-move-out inspection in writing, regardless of whether the tenant requests one. Conduct the move-out inspection on the same standard as the move-in. Itemize deductions with supporting documentation. Issue the return and the itemized statement within 14 days of the end of the tenancy.
Most of this is process discipline rather than legal complexity. A platform that handles NYC leasing should generate compliant deposit language, prompt for the disclosures, and store inspection records alongside the lease. The harder part — actually conducting the inspections and producing the documentation on time — sits with the landlord. But once the lease itself is correct and the workflow is in place, the dispute risk drops significantly.
The cost of getting security deposits right is a few hours of process. The cost of getting them wrong is the full deposit plus, in some cases, statutory damages and attorney's fees. The math is straightforward.